Overview

overview

7

Static

static

3

Nexus/VST/....4.dll

windows7-x64

7

Nexus/VST/....4.dll

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nexus.zip

  • Size

    8.6MB

  • Sample

    240630-wn8kws1hka

  • MD5

    3515bebfad2ce1c271f7ed0321aa0924

  • SHA1

    3f9e7682f94cc8c47242bd1617a84a660c1d05ee

  • SHA256

    751b99f4ac429b35b5905af5803d150ae4240f931d2ff4a239d9c1f9babd791c

  • SHA512

    4ba8fe73bbc140e19b6f7b48a89b2a8a84203d0e822470f648d68ba505baa455cb1894833c8758d0127ea4f8df5927b9916329cf0c057bd712ddce30a1b86fff

  • SSDEEP

    196608:9Fhzxn/EN5hwZ31joTCAAPZY0usOd0QfkOmg9m/XcvAsO+1qkcnS:V9/EGuCPhpusOddrhckgG2S

Score
7/10
bootkitpersistence

Malware Config

Targets

    • Target

      Nexus/VST/Nexus3.4.4.dll

    • Size

      8.5MB

    • MD5

      3f5d64b7e6bf4d6f9cebe8a180ba3c2b

    • SHA1

      3f7d18309274daf0a39c501c71d18c1229496721

    • SHA256

      88961cd14b71041a5139dd58a263d00addb91b96f53db51fb57ff30bb2b46c75

    • SHA512

      bf95fafb6f5c9330b0c3491541796710961ddb9b72a9c8458ddf2076b089c3e9a6bf24daeb348274a3109cef4aab21a1f13d95f1f66c7e3ffd2cd10c5e96701a

    • SSDEEP

      196608:De3Bhdgk7cBITaNXhmJGIMYga5EoiKEyQB6/jeXXl+raZgUt:DeXd1cI6XhmJWYgatTEyGXo

    Score
    7/10
    bootkitpersistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks